Description
IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions, caused by cluster-scoped RBAC objects being keyed solely by the bare CR name with no namespace disambiguation, allowing a same-named `InstanaAgent` CR in an attacker-controlled namespace to silently overwrite the shared `ClusterRoleBinding` or delete it outright and revoke the victim agent's cluster monitoring access.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| IBM | Observability with Instana (Agent) | Build 1.0.303 – ≤ 1.0.323 | — |
References
- https://www.ibm.com/support/pages/node/7286070 vendor-advisory patch